-
Bug
-
Resolution: Fixed
-
Low
-
2.10
-
None
As an administrator, try to add a user with a username such as "a+b"
The new user will be created, but the username is stripped of the plus and so created as "a b"
Now enable public signup, and create a new user with username "a+b". This will succeed.
Allowing users with dodgy characters causes issues such as CONF-15920 and CONF-15921. The validation on usernames for public signup should be at least as strict as the administrative add user screen.
Also, the UI should give a warning message, rather than silently stripping characters.
- causes
-
CONFSERVER-15970 XSS in user links
- Closed
- is related to
-
CONFSERVER-20656 Whitespace in usernames umbrella issue
- Closed
- relates to
-
CONFSERVER-15921 Profile and Status navigations are not working for a username which contains plus character
- Closed
-
CONFSERVER-15920 User Hover is not working for a username which contains plus characters
- Closed